The ISO 27001 Clause 7.1 audit checklist is designed to help an ISO 27001 Lead Auditor conduct internal audits and external audits of ISO 27001 Clause 7.1 Resources.
The 10 point ISO 27001 audit plan sets out what to audit, the challenges faced and the audit techniques to adopt.
With over 30 years industry experience I will show you the audit checklist used by professional ISO 27001 Lead Auditors for ISO 27001 certification.
I am Stuart Barker, author of the Ultimate ISO 27001 Toolkit and this is the ISO 27001 Resources audit checklist.
Ensure Personnel Competence
This involves confirming that individuals involved in the ISMS possess the necessary skills, knowledge, and experience to perform their assigned roles effectively.
Challenges
Identifying the specific competencies required for each role can be complex. Keeping up with evolving technologies and threats requires continuous professional development. Attracting and retaining qualified personnel, especially in cybersecurity, is a constant struggle. Budget constraints can limit training opportunities.
Audit Techniques
Document review (job descriptions, training records, competency frameworks)
Interviews with personnel
Observation of personnel performing tasks
Review of certifications and qualifications
Evaluate Infrastructure Provision
This focuses on verifying that the necessary infrastructure (hardware, software, facilities) is available, suitable, and adequately maintained to support the ISMS.
Challenges
Predicting future infrastructure needs can be difficult. Balancing performance, security, and cost is a delicate act. Integrating new technologies while maintaining compatibility with existing systems presents ongoing challenges. Supply chain disruptions can impact timely provisioning.
Audit Techniques
Document review (asset inventory, infrastructure diagrams, maintenance records)
Interviews with IT and facilities personnel
Physical inspection of infrastructure
Review of capacity planning documentation
Examine Financial Resource Allocation
This involves ensuring that sufficient financial resources are allocated to the ISMS to support its objectives and planned activities.
Challenges
Justifying ISMS spending to senior management can be difficult, especially when the benefits are not always immediately tangible. Competing priorities for funding can squeeze the ISMS budget. Accurately tracking and reporting on ISMS expenditures is essential but can be complex.
Audit Techniques
Document review (budget documents, financial statements)
Interviews with budget holders and finance personnel
Analysis of ISMS spending and its alignment with planned activities
Assess Management Support
This verifies that top management demonstrates a visible commitment to the ISMS by providing adequate resources, setting clear expectations, and actively participating in ISMS activities.
Challenges
Maintaining consistent management support over time can be difficult, especially when other business priorities emerge. Translating management commitment into concrete actions and resource allocation is crucial. Demonstrating the return on investment of ISMS activities to management is often a challenge.
Audit Techniques
Interviews with top management
Review of management review meeting minutes
Examination of resource allocation decisions and their justification
Observation of management involvement in ISMS activities
Evaluate Resource Maintenance
This ensures that resources (hardware, software, skills, etc.) are properly maintained and kept up-to-date to ensure their continued effectiveness and availability.
Challenges
Keeping up with software patches and upgrades can be a resource-intensive task. Balancing the need for timely maintenance with the potential disruption to operations is a constant challenge. Ensuring that maintenance activities are performed correctly and documented thoroughly is essential.
Audit Techniques
Document review (maintenance schedules, upgrade plans, patch management records)
Interviews with IT and facilities personnel
Observation of maintenance activities
Review of vendor contracts for support and maintenance
Examine Outsourced Processes
If any ISMS-related processes are outsourced, this verifies that the service provider has the necessary resources and competence to perform those processes effectively.
Challenges
Maintaining oversight and control over outsourced processes can be difficult. Ensuring that service providers meet the organisation’s security requirements and SLAs is crucial. Communication and coordination with service providers can be complex.
Audit Techniques
Document review (contracts with service providers, SLAs)
Interviews with service provider management
Review of service provider audit reports and certifications
Analysis of service provider performance data
Assess Resource Allocation Documentation
This verifies that accurate and up-to-date records of resource allocation for the ISMS are maintained.
Challenges
Keeping resource allocation documentation current and accurate can be time-consuming. Integrating resource allocation data with other ISMS documentation can be complex. Ensuring that all relevant stakeholders have access to the necessary information is important.
Audit Techniques
Document review (resource allocation records, asset registers)
Interviews with resource owners and administrators
Examination of resource tracking systems and databases
Evaluate Resource Needs Review
This ensures that resource needs for the ISMS are regularly reviewed and updated to reflect changes in business requirements, threats, and technology.
Challenges
Accurately forecasting future resource needs can be difficult. Ensuring that resource planning is aligned with the overall ISMS strategy is essential. Regularly reviewing resource needs can be a time-consuming process.
Audit Techniques
Review of management review outputs
Interviews with management and resource owners
Examination of resource planning documents and their updates
Analysis of changes in ISMS requirements and their impact on resource needs
Assess Resource Utilisation Improvement
This verifies that the organization actively seeks opportunities to improve the efficiency and effectiveness of resource utilisation within the ISMS.
Challenges
Identifying opportunities for resource optimisation can be challenging. Implementing changes to resource utilisation practices can be disruptive. Measuring the effectiveness of resource optimisation initiatives is important but can be complex.
Audit Techniques
Interviews with management and staff
Review of process improvement initiatives related to resource management
Analysis of resource usage data and metrics
Examination of resource optimisation plans
Further Reading
ISO 27001 Clause 7.1 Resources
